Skip to content

Commit bc55abc

Browse files
roxanan1996roxanan1996
committed
github actions: Introduce kernel-build-and-test-multiarch-trigger.yml
Separate the workflow into 2: - trigger (that does not do much, appart from saving params and PR information metadata) - and the actual workflow that gets triggered automatically after this workflow is done. Needed so we can run this for forked repos. First workflow is "safer" because it is triggered in the PR context. The second workflow is triggered by workflow_run which always runs in the base repo context, and it has full access to secrets (APP_ID, APP_PRIVATE_KEY) The modified worklow kernel-build-and-test-multiarch.yml will be added later. Signed-off-by: Roxana Nicolescu <rnicolescu@ciq.com>
1 parent db0f84f commit bc55abc

1 file changed

Lines changed: 137 additions & 0 deletions

File tree

‎.github/workflows/kernel-build-and-test-multiarch-trigger.yml‎

Lines changed: 137 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,137 @@
1+
name: Trigger Automated kernel build and test (multi-arch)
2+
3+
on:
4+
workflow_call:
5+
inputs:
6+
architectures:
7+
description: 'Comma-separated architectures to build (x86_64, aarch64)'
8+
required: false
9+
type: string
10+
default: 'x86_64,aarch64'
11+
skip_kabi:
12+
description: 'Skip kABI compatibility check'
13+
required: false
14+
type: boolean
15+
default: false
16+
17+
permissions:
18+
contents: read
19+
actions: read
20+
packages: read
21+
# No pull-requests: write needed - we don't comment here
22+
23+
jobs:
24+
trigger-kernelCI:
25+
runs-on: ubuntu-latest
26+
27+
steps:
28+
- name: Validate and sanitize inputs
29+
id: validate_inputs
30+
env:
31+
BASE_REF: ${{ github.base_ref }}
32+
HEAD_REF: ${{ github.head_ref }}
33+
PR_NUMBER: ${{ github.event.pull_request.number }}
34+
PR_COMMITS: ${{ github.event.pull_request.commits }}
35+
run: |
36+
# Validate base branch name (alphanumeric, dots, slashes, dashes, underscores, curly braces)
37+
# Note: hyphen must be at end of character class or escaped to be literal
38+
if ! [[ "$BASE_REF" =~ ^[a-zA-Z0-9/_.{}-]+$ ]]; then
39+
echo "❌ Invalid base branch name: $BASE_REF"
40+
exit 1
41+
fi
42+
43+
# Validate head branch name
44+
if ! [[ "$HEAD_REF" =~ ^[a-zA-Z0-9/_.{}-]+$ ]]; then
45+
echo "❌ Invalid head branch name: $HEAD_REF"
46+
exit 1
47+
fi
48+
49+
# Validate length (prevent resource exhaustion)
50+
if [ ${#BASE_REF} -gt 255 ]; then
51+
echo "❌ Base branch name too long"
52+
exit 1
53+
fi
54+
55+
if [ ${#HEAD_REF} -gt 255 ]; then
56+
echo "❌ Head branch name too long"
57+
exit 1
58+
fi
59+
60+
# Validate PR number is numeric
61+
if ! [[ "$PR_NUMBER" =~ ^[0-9]+$ ]]; then
62+
echo "❌ Invalid PR number: $PR_NUMBER"
63+
exit 1
64+
fi
65+
66+
# Validate commits count is numeric
67+
if ! [[ "$PR_COMMITS" =~ ^[0-9]+$ ]]; then
68+
echo "❌ Invalid commits count: $PR_COMMITS"
69+
exit 1
70+
fi
71+
72+
# Pass validated values to environment
73+
echo "BASE_REF=$BASE_REF" >> "$GITHUB_ENV"
74+
echo "HEAD_REF=$HEAD_REF" >> "$GITHUB_ENV"
75+
echo "PR_NUMBER=$PR_NUMBER" >> "$GITHUB_ENV"
76+
echo "PR_COMMITS=$PR_COMMITS" >> "$GITHUB_ENV"
77+
78+
- name: Clone base branch
79+
env:
80+
BASE_CLONE_URL: ${{ github.event.pull_request.base.repo.clone_url }}
81+
run: |
82+
# Use environment variables to prevent injection
83+
git clone --depth=1 --no-checkout "$BASE_CLONE_URL" -b "$BASE_REF" .
84+
85+
- name: Fetch PR branch
86+
env:
87+
HEAD_CLONE_URL: ${{ github.event.pull_request.head.repo.clone_url }}
88+
run: |
89+
# Use environment variables to prevent command injection
90+
git fetch --depth=$((PR_COMMITS + 1)) "$HEAD_CLONE_URL" "$HEAD_REF"
91+
HEAD_SHA=$(git rev-parse FETCH_HEAD)
92+
93+
# Validate SHA format (40 hex characters)
94+
if ! [[ "$HEAD_SHA" =~ ^[0-9a-f]{40}$ ]]; then
95+
echo "❌ Invalid SHA format: $HEAD_SHA"
96+
exit 1
97+
fi
98+
99+
echo "HEAD_SHA=$HEAD_SHA" >> "$GITHUB_ENV"
100+
101+
- name: Verify PR branch isn't on stale base
102+
run: |
103+
if ! git merge-base --is-ancestor "$BASE_REF" "$HEAD_SHA"; then
104+
echo "❌ PR branch must be rebased onto latest base branch commit"
105+
exit 1
106+
fi
107+
108+
- name: Save PR metadata for workflow
109+
env:
110+
HEAD_REPO_FULL_NAME: ${{ github.event.pull_request.head.repo.full_name }}
111+
REPOSITORY: ${{ github.repository }}
112+
ARCHITECTURES: ${{ inputs.architectures }}
113+
SKIP_KABI: ${{ inputs.skip_kabi }}
114+
run: |
115+
mkdir -p pr_metadata
116+
117+
# Save validated metadata
118+
echo "$PR_NUMBER" > pr_metadata/pr_number.txt
119+
echo "$REPOSITORY" > pr_metadata/repository.txt
120+
echo "$BASE_REF" > pr_metadata/base_ref.txt
121+
echo "$HEAD_REF" > pr_metadata/head_ref.txt
122+
echo "$HEAD_SHA" > pr_metadata/head_sha.txt
123+
echo "$HEAD_REPO_FULL_NAME" > pr_metadata/head_repo.txt
124+
echo "$ARCHITECTURES" > pr_metadata/architectures.txt
125+
echo "$SKIP_KABI" > pr_metadata/skip_kabi.txt
126+
127+
# Create a checksum of metadata for integrity verification
128+
(cd pr_metadata && sha256sum *.txt > checksums.txt)
129+
130+
- name: Upload check results
131+
uses: actions/upload-artifact@v4
132+
if: always() # Upload even if checks fail
133+
with:
134+
name: check-results
135+
path: |
136+
pr_metadata/
137+
retention-days: 3 # Increased from 1 (then 3) to prevent premature deletion and support manual follow-ups

0 commit comments

Comments
 (0)